QID 352472

<DIV ID="issue_overview"> a flaw was discovered in postgresql where arbitrary sql statements can be executed given a suitable security definer function.
An attacker, with execute permission on the function, can execute arbitrary sql as the owner of the function. (
cve-2019-10208 ) a flaw was found in postgresql.
If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist.
The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. (
cve-2020-25694 ) a flaw was found in postgresql.
An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary sql functions under the identity of a superuser.
cve-2020-25695 ) </DIV>

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.